Splunk Search

License Usage by Host over time

dbecker_AU
Engager

We are using Splunk 6.0.1, and I found a search that generates license usage by host:

index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB

What I'd like to do is extend it further to 24 hour spans. The closest I've come is breaking it down by day:

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | timechart per_day(MB) by h span=24h

...but the end always shows today's stats looking much lower because there isn't enough data.

Is there a way to get per_day to start at the current time rather than midnight?

0 Karma

rmorlen
Splunk Employee
Splunk Employee

You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this.

index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed

You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that.

lukejadamec
Super Champion

Use the time picker and select the days from midnight to midnight.

0 Karma

dbecker_AU
Engager

I tried that, but it still divides by calendar day, so today only reports from midnight to the current time.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...